PatchTheCVEgarmin vulnerabilities
Recent CVEs affecting garmin products. 4 tracked.
garmin has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2026-05-13. Highest priority: CVE-2025-27850 (score 39/100).
- CVE-2025-27853 HIGH 7.3 MITIGATE The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed
- CVE-2025-27852 MEDIUM 5.0 MITIGATE The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (X
- CVE-2025-27851 CRITICAL 9.3 MITIGATE The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijac
- CVE-2025-27850 HIGH 7.5 MITIGATE The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack
FAQ
How do I fix garmin vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is garmin being exploited right now?
None of the tracked garmin CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which garmin CVE should I patch first?
CVE-2025-27850 currently ranks highest (39/100): The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack.